Tools · Smaller checks
Is this proof enough?
For a security leader finding out what an inherited programme really does. Choose what you were shown for one claim, and see the finding it supports, what to do next and what proof to ask for. Nothing is stored. It tells you which finding word the evidence supports in the discovery week. It does not judge whether an auditor would accept it.
Question 1 of 2
Think of one claim: something you were told, or a document says, about the programme you inherited. Choose what you were shown for it. Nothing you choose is kept. The answer is the finding word the evidence supports in the discovery week, not a judgement of whether an auditor would accept it.
The finding
This tells you which finding word the evidence supports in the discovery week. It does not judge whether an auditor would accept it.
Choose what you were shown, and the finding word appears here.
Record the finding in the workbook, not here. This page has no place for the claim or what you saw, and keeps nothing you choose. If you accepted analytics, we count how far people get through the questions, never what they answer. TheInherited Security Programme Discovery Workbook holds each finding with what you saw and when.
The four finding words
A finding is one of these, with what was seen. A blank row reads Not yet looked at. It is not a finding.
- Evidenced
- A record, a test result or a system view that you saw matches what you were told or what the document says.
- Described only
- You were told, or a document claims it, and you have seen nothing that shows it is done.
- Not found
- You asked for it, by a date, and nothing was produced and nothing could be found.
- Contradicted
- What you saw differs from what you were told or what the document says.
How this works, and what it is not
The finding follows from what you were shown, by the workbook's rule:
TR-02. Every discovery finding states what was seen: a record, a test result or a system view. A statement alone is Described only. A finding is checked again after 6 months, or on a material change.
A record, a test or a view of the system that matches the claim is Evidenced. A statement, from a person or a document, is Described only. Nothing produced, once you asked by a date and the date passed, is Not found; before then the item is not yet looked at. What you saw that differs from the claim is Contradicted. A Record is a document or a file you read. A Test is something you do or check yourself, on a sample. A System view is what the system shows you, on screen, with its dates.
What it is not
- Not a record. It keeps no claim, no finding and no date. The workbook holds each finding with what you saw, when you looked and the follow-up.
- Not a maturity level. Evidenced is at least Seen in P19's words, and Described only is Told. A finding is not a maturity level. A level is set by P19's rules, from a sample of records.
- Not a judgement of the proof's quality. It takes your word that what you saw matches the claim. A sample too small, or a record that covers only part of the claim, is for you to weigh.